---
id: CVE-2026-95698
title: >-
  The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by
  concatenating a user-supplied organization identifier with a fixed image
  directory and a file extension, then calls file_exists() on the resulting path
summary: >-
  The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by
  concatenating a user-supplied organization identifier with a fixed image
  directory and a file extension, then calls file_exists() on the resulting
  path. The o…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:18:23.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95698'
references:
  - url: 'https://github.com/MISP/MISP/commit/e00986075'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T15:03:36.684296Z'
cvssSource: cna
ingestedAt: '2026-09-22T15:05:01.084Z'
---

## Overview

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory. 

This yields two security impacts: 

 - an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access.
 - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.




The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.